Most of Wasmtime's own code supports `no_std`, but it needs things like
locks and it currently has dependencies
for calling `mmap`, `mprotect`, and related functionality which do not
support `no_std`.
Wasmtime does not yet provide any protection against Spectre or Rowhammer.